On 25 Apr 2014, at 07:02, <peter.geiser@id.unibe.ch> <peter.geiser@id.unibe.ch> wrote:
When you use AD then the following simple query will do all the hard workŠ
Recursive Group Memberships (member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn})
Or as config snipped:
group { base_dn = 'dc=foo,dc=bar' scope = 'sub' name_attribute = cn membership_filter = "(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn})"
cacheable_name = "yes" cacheable_dn = "no" }
Woha, crazy. I don't even want to know what black magic that's invoking. Do you have any documentation on it? It'd be good to include a note in the default config. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2